Crypto-linked Visa debit card provider Gnosis Pay disclosed a security breach on Friday that exposed customers’ payment card details, home addresses and cryptocurrency wallet addresses.
Unauthorized access to Gnosis Pay’s legacy consumer card system was detected on November 3 and contained within two hours, according to the company. The breach exposed full payment card numbers, expiration dates, CVV codes, customer names, home addresses, wallet addresses, email addresses, phone numbers, nationalities, and in some cases IBAN and BIC banking details.
Gnosis Pay said customer funds remained safe despite the exposure. The company’s separate enterprise platform, which powers white-label card programs, was unaffected by the incident. The affected customer’s card was canceled on November 3 with no suspicious transactions or movement of funds detected.
According to OpenRate data tracking crypto card activity, Gnosis Pay had 2,400 daily active cardholders and processed $263,200 in transactions in the 24 hours prior to the breach disclosure.
Response and containment measures
Gnosis Pay replaced compromised security credentials and addressed the vulnerability. The company made 3D Secure verification mandatory for online payments until the legacy system’s planned retirement on December 20, 2026.
The company warned customers about potential phishing attempts and arranged monitoring for potential misuse of stolen data. Gnosis Pay did not disclose the total number of affected customers or name the specific vulnerability exploited.
Cointelegraph sought comment from Gnosis Pay but received no response.
